Silent fallback from expired subscription OAuth to legacy API credentials drains Console credits without warning

Summary

When the claude.ai subscription OAuth session expires, Claude Code does not prompt for re-authentication. Instead, it silently falls back to leftover legacy credentials (~/.claude/.credentials.json, ~/.config/anthropic/credentials/) and continues serving requests billed to Console API credits — with no warning that the billing source changed. The user only discovers this when their Console credit balance is drained to $0 and every session starts failing with "Credit balance is too low".

Environment

• Claude Code 2.1.232, macOS 26.5.1
• Active Claude Max 5x subscription ($100/mo), extra usage disabled
• Legacy Console credentials existed on the machine from an earlier (April) Console setup

What happened

1. Daily Claude Code usage on an active Max subscription (keychain shows claudeAiOauth, subscriptionType: max).
2. At some point the subscription OAuth session expired/broke.
3. Instead of stopping with a re-login prompt, Claude Code picked up legacy credentials and kept working — every conversation silently billed Console API credits at API rates.
4. Console balance drained to $0 (~$60 lost across a few days, on top of unrelated app usage). All sessions then failed with "Credit balance is too low" — a confusing error for a subscriber who never intended to use API billing.
5. Support confirmed the behavior but stated consumed credits are non-refundable, "even when usage resulted from authentication fallback behavior".

Expected behavior

• When subscription auth expires: stop and prompt for re-login. Never switch billing sources silently.
• If a fallback to API credentials is ever intentional, it must require explicit user confirmation ("Your subscription session expired. Continue using API credits at API rates? [y/N]") and show a persistent indicator of the active billing source.

Actual behavior

Silent switch from subscription to API billing; no notice, no indicator; discovery only via drained Console balance.

Workaround (what we had to do manually)

• Delete ~/.claude/.credentials.json and ~/.config/anthropic/credentials/
• Pin "forceLoginMethod": "claudeai" in ~/.claude/settings.json
• Install a SessionStart hook + a cron watchdog that deletes any reappearing legacy credential files

Ordinary subscribers will not know to do any of this. Given API rates, a subscriber who hits this can burn hundreds of dollars before noticing. Please treat the silent billing-source switch as a defect.